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Application No.: 09/825,139 
Amendment dated: March 28, 2005 
Reply to Office Action of December 2, 2004 
Attorney Docket No.: 0016.0007US1 

a.) Amendments to Specification 

Replace the paragraph beginning at page 1, line 12, in the specification as originally 
filed, with the following rewritten paragraph: 

-With advances in integrated circuit, microprocessor, networking and 
communication technologies, increasing number of devices, in particular, digital 
computing devices, are being networked together. Devices are often first coupled to a 
local area network, such as an Ethernet based office/home network. In turn, the local 
area networks are interconnected together through wide area networks, such as ATM 
networks, Frame Relays, and the like. Of particular notori e ty relevance is the TCP/IP 
based global inter-networks, Internet. -- 

Replace the paragraph beginning at page /, line 16 t in the specification as originally 
filed, with the following rewritten paragraph: 

-As a result of this trend of increased connectivity, increasing numbers of 
applications that are network dependent are being deployed. Examples of these network 
dependent applications include but are not limited to, email, net based telephony, world 
wide web and various types of e-commerce. Success of many of these content/service 
providers as well as commerce sites depend on the quality of service that they provide.— 

Replace the paragraph beginning at page 4, line 11, in the specification as originally 
filed, with the following rewritten paragraph: 

—Parts of the description will be presented in terms of operations performed by a 
processor based device, using terms such as nonce, identifiers, generating, inserting 
receiving, analyzing, determining, and the like, consistent with the manner commonly 
employed by those skilled in the art to convey the substance of their work to others 
skilled in the art. As well understood by those skilled in the art, the quantities take the 
form of electrical, magnetic, or optical signals capable of being stored, transferred, 
combined, and otherwise manipulated through mechanical and electrical components of 
the processor based device; and the term processor includes microprocessors, micro- 
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controllers, digital signal processors, and the like, that are standalone, adjunct or 
embedded.— 

Replace the paragraph beginning at page 6, line 19, in the specification as originally 
filed, with the following rewritten paragraph: 

— As a result, undesirable packets destined for servers 102a-120n may be 
advantageously detected and filtered by selected ones of routing devices 108 
independently. As those skilled in the art would appreciate, under the novel approach of 
the present invention, the advantageous independent detection and filtering is effectuated 
notwithstanding the fact that the packets transmitted from servers 102a- 102n to client 
devices 104a-104n may or may not be routed through the same routing devices 108. 
Specifically, there is no requirement for routing devices 108 to maintain state flow 
information in order to accomplish the independent detection and filtering. This ability 
of allowing any properly equipped routing device 108 to independently analyze and make 
a judgment on a received en-route packet enables any routing device 108 disposed in any 
one of a number of locations in internetworking fabric 106 to be so configured as to 
perform the independent undesirable packet detection and filtering. Thus, the present 
invention enhances the ability to provide early detection and filtering of undesirable 
packets, soon after the undesirable packets entered the network.-- 

Replace the paragraph beginning at page 7, line 8, in the specification as originally filed, 
with the following rewritten paragraph: 

—Still referring to Figures 1-2, except for the teachings of the present invention 
incorporated with selected ones of routing devices 108, servers 102a-102n and client 
devices 104a- 10411, these elements, including internetworking fabric 108 a are intended to 
represent a broad range of servers, client devices, routing devices, and public/private 
networks known in the art. Routing devices 108 e.g. may be routers, switches, and the 
like, available from CISCO Systems of San Jose, CA, or Juniper Network, of Sunnyvale, 
CA. Servers 102a-102n may be servers available from Sim Microsystems of Menlo Park, 
CA, or IBM of Armonk, NY, whereas client devices 104a-104n e.g. may be computing 
devices of any form factors, from desktop to palm sized, available from Hewlett Packard 
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of Palo Alto, CA. Internetworking fabric 106 may be inter-networked (wired and/or 
wireless) private networks of a private enterprise, or public networks (such as the 
Internet). Thus, except for the teachings of the present invention, these elements will not 
be otherwise described.— 

Replace the paragraph beginning at page 10 , line3 , in the specification as originally 
filed, with the following rewritten paragraph: 

-As illustrated in Figure 4, for the embodiment, the relevant components of the 
communication interface of the host server include generator 408_and a transmit 
interface. Generator 408 includes a deterministic function configured to generate a nonce 
based on a number of input values, including selected persistent information extracted 
from the packet and a secret value. Generator 408 "adds" the generated nonce into a 
predetermined field of the packet to be transmitted by the transceiver. For the 
embodiment, the components include register 406 for holding the secret value. Further, 
the input values to generator 408 include a sequence number of the nonce to be 
generated, and the components include counter 404 for generating the sequence number 
of the nonce.— 

Replace the paragraph beginning at page 11 , line! , in the specification as originally 
filed, with the following rewritten paragraph: 

-As illustrated in Figure 7, for the embodiment, the relevant components of the 
communication interface of the host client device include storage cache 706, associated 
write pointer 704, and a transceiver (not shown). Storage cache 706 is used to store the 
server addresses, the included nonces and the sequence numbers of the nonces extracted 
from a packet received by the transceiver. Write pointer 704 is employed to denote the 
next storage location for use to store the most recently extracted data. In one 
embodiment, write pointer 704 is "advanced" or set employing a least recently used 
(LRU) replacement policy. For the illustrated embodiment, storage cache 706 is content 
addressable, allowing the most recent stored copy of the nonce (and its sequence number) 
for a server to be output for inclusion in a packet to be transmitted to a server by the 
transceiver, in response to the provision of the server's address as input. In another 
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embodiment, the sequence number may be used to index the nonces instead. For this 
embodiment, the server may advance the sequence number periodically. Upon 
advancement, all nonces having "older" associated sequence numbers are considered 
"expired". Accordingly, the server and the routing device may signal each other and be 
synchronized to one another, without resorting to an operationally "expensive" 
distribution process to distributing keys/secrets to the routing devices.- 
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